memory: add a sparse memory device for fuzzing

For testing, it can be useful to simulate an enormous amount of memory
(e.g. 2^64 RAM). This adds an MMIO device that acts as sparse memory.
When something writes a nonzero value to a sparse-mem address, we
allocate a block of memory. For now, since the only user of this device
is the fuzzer, we do not track and free zeroed blocks. The device has a
very low priority (so it can be mapped beneath actual RAM, and virtual
device MMIO regions).

Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
This commit is contained in:
Alexander Bulekov 2021-03-15 10:05:10 -04:00 committed by Paolo Bonzini
parent d7da0e5601
commit 230376d285
4 changed files with 172 additions and 0 deletions

View File

@ -2636,6 +2636,7 @@ S: Maintained
F: tests/qtest/fuzz/ F: tests/qtest/fuzz/
F: tests/qtest/fuzz-*test.c F: tests/qtest/fuzz-*test.c
F: scripts/oss-fuzz/ F: scripts/oss-fuzz/
F: hw/mem/sparse-mem.c
F: docs/devel/fuzzing.rst F: docs/devel/fuzzing.rst
Register API Register API

View File

@ -1,5 +1,6 @@
mem_ss = ss.source_set() mem_ss = ss.source_set()
mem_ss.add(files('memory-device.c')) mem_ss.add(files('memory-device.c'))
mem_ss.add(when: 'CONFIG_FUZZ', if_true: files('sparse-mem.c'))
mem_ss.add(when: 'CONFIG_DIMM', if_true: files('pc-dimm.c')) mem_ss.add(when: 'CONFIG_DIMM', if_true: files('pc-dimm.c'))
mem_ss.add(when: 'CONFIG_NPCM7XX', if_true: files('npcm7xx_mc.c')) mem_ss.add(when: 'CONFIG_NPCM7XX', if_true: files('npcm7xx_mc.c'))
mem_ss.add(when: 'CONFIG_NVDIMM', if_true: files('nvdimm.c')) mem_ss.add(when: 'CONFIG_NVDIMM', if_true: files('nvdimm.c'))

151
hw/mem/sparse-mem.c Normal file
View File

@ -0,0 +1,151 @@
/*
* A sparse memory device. Useful for fuzzing
*
* Copyright Red Hat Inc., 2021
*
* Authors:
* Alexander Bulekov <alxndr@bu.edu>
*
* This work is licensed under the terms of the GNU GPL, version 2 or later.
* See the COPYING file in the top-level directory.
*/
#include "qemu/osdep.h"
#include "exec/address-spaces.h"
#include "hw/qdev-properties.h"
#include "hw/sysbus.h"
#include "qapi/error.h"
#include "qemu/units.h"
#include "sysemu/qtest.h"
#include "hw/mem/sparse-mem.h"
#define SPARSE_MEM(obj) OBJECT_CHECK(SparseMemState, (obj), TYPE_SPARSE_MEM)
#define SPARSE_BLOCK_SIZE 0x1000
typedef struct SparseMemState {
SysBusDevice parent_obj;
MemoryRegion mmio;
uint64_t baseaddr;
uint64_t length;
uint64_t size_used;
uint64_t maxsize;
GHashTable *mapped;
} SparseMemState;
typedef struct sparse_mem_block {
uint8_t data[SPARSE_BLOCK_SIZE];
} sparse_mem_block;
static uint64_t sparse_mem_read(void *opaque, hwaddr addr, unsigned int size)
{
SparseMemState *s = opaque;
uint64_t ret = 0;
size_t pfn = addr / SPARSE_BLOCK_SIZE;
size_t offset = addr % SPARSE_BLOCK_SIZE;
sparse_mem_block *block;
block = g_hash_table_lookup(s->mapped, (void *)pfn);
if (block) {
assert(offset + size <= sizeof(block->data));
memcpy(&ret, block->data + offset, size);
}
return ret;
}
static void sparse_mem_write(void *opaque, hwaddr addr, uint64_t v,
unsigned int size)
{
SparseMemState *s = opaque;
size_t pfn = addr / SPARSE_BLOCK_SIZE;
size_t offset = addr % SPARSE_BLOCK_SIZE;
sparse_mem_block *block;
if (!g_hash_table_lookup(s->mapped, (void *)pfn) &&
s->size_used + SPARSE_BLOCK_SIZE < s->maxsize && v) {
g_hash_table_insert(s->mapped, (void *)pfn,
g_new0(sparse_mem_block, 1));
s->size_used += sizeof(block->data);
}
block = g_hash_table_lookup(s->mapped, (void *)pfn);
if (!block) {
return;
}
assert(offset + size <= sizeof(block->data));
memcpy(block->data + offset, &v, size);
}
static const MemoryRegionOps sparse_mem_ops = {
.read = sparse_mem_read,
.write = sparse_mem_write,
.endianness = DEVICE_LITTLE_ENDIAN,
.valid = {
.min_access_size = 1,
.max_access_size = 8,
.unaligned = false,
},
};
static Property sparse_mem_properties[] = {
/* The base address of the memory */
DEFINE_PROP_UINT64("baseaddr", SparseMemState, baseaddr, 0x0),
/* The length of the sparse memory region */
DEFINE_PROP_UINT64("length", SparseMemState, length, UINT64_MAX),
/* Max amount of actual memory that can be used to back the sparse memory */
DEFINE_PROP_UINT64("maxsize", SparseMemState, maxsize, 10 * MiB),
DEFINE_PROP_END_OF_LIST(),
};
MemoryRegion *sparse_mem_init(uint64_t addr, uint64_t length)
{
DeviceState *dev;
dev = qdev_new(TYPE_SPARSE_MEM);
qdev_prop_set_uint64(dev, "baseaddr", addr);
qdev_prop_set_uint64(dev, "length", length);
sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
sysbus_mmio_map_overlap(SYS_BUS_DEVICE(dev), 0, addr, -10000);
return &SPARSE_MEM(dev)->mmio;
}
static void sparse_mem_realize(DeviceState *dev, Error **errp)
{
SparseMemState *s = SPARSE_MEM(dev);
SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
if (!qtest_enabled()) {
error_setg(errp, "sparse_mem device should only be used "
"for testing with QTest");
return;
}
assert(s->baseaddr + s->length > s->baseaddr);
s->mapped = g_hash_table_new(NULL, NULL);
memory_region_init_io(&s->mmio, OBJECT(s), &sparse_mem_ops, s,
"sparse-mem", s->length);
sysbus_init_mmio(sbd, &s->mmio);
}
static void sparse_mem_class_init(ObjectClass *klass, void *data)
{
DeviceClass *dc = DEVICE_CLASS(klass);
device_class_set_props(dc, sparse_mem_properties);
dc->desc = "Sparse Memory Device";
dc->realize = sparse_mem_realize;
}
static const TypeInfo sparse_mem_types[] = {
{
.name = TYPE_SPARSE_MEM,
.parent = TYPE_SYS_BUS_DEVICE,
.instance_size = sizeof(SparseMemState),
.class_init = sparse_mem_class_init,
},
};
DEFINE_TYPES(sparse_mem_types);

View File

@ -0,0 +1,19 @@
/*
* A sparse memory device. Useful for fuzzing
*
* Copyright Red Hat Inc., 2021
*
* Authors:
* Alexander Bulekov <alxndr@bu.edu>
*
* This work is licensed under the terms of the GNU GPL, version 2 or later.
* See the COPYING file in the top-level directory.
*/
#ifndef SPARSE_MEM_H
#define SPARSE_MEM_H
#define TYPE_SPARSE_MEM "sparse-mem"
MemoryRegion *sparse_mem_init(uint64_t addr, uint64_t length);
#endif